CVE-2026-78329

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9

Description Improper input validation in the Apache Camel Undertow component occurs because the UndertowEndpoint incorrectly defaults its headerFilterStrategy field to the base HttpHeaderFilterStrategy. This action overwrites the UndertowHeaderFilterStrategy installed by the DefaultUndertowHttpBinding, causing undertow-specific filtering to be bypassed on endpoint-configured routes. Consequently, the legacy websocket. Exchange-header prefix is not filtered at the transport boundary. This allows an undertow HTTP consumer to map inbound wire headers onto the Exchange, which an undertow WebSocket producer may then interpret as dispatch directives to deliver messages to an unintended peer. Additionally, header names rejected by undertow are mapped onto the Exchange instead of being skipped. This issue does not affect Rest DSL consumers as they use UndertowRestHeaderFilterStrategy.

Recommendations Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.4 for those on the 4.18.x releases stream. Upgrade to version 4.22.0. As a temporary workaround, explicitly configure the strategy by binding an UndertowHeaderFilterStrategy in the registry and referencing it on the endpoint, and use removeHeaders("websocket.*") to strip dispatch headers at the trust boundary.